ML-DSA in X.509 Certificates: What the IETF RFCs Specify

Short answer: RFC 9881 specifies how to use ML-DSA (FIPS 204) in Internet X.509 certificates and Certificate Revocation Lists, and RFC 9882 specifies its use in the Cryptographic Message Syntax (CMS). Both cover three security levels: ML-DSA-44, ML-DSA-65 and ML-DSA-87. RFC 9881 specifies only the pure variant of ML-DSA, not the pre-hashed variant.

Scope of Specification in PKIX

RFC 9881 specifies the conventions for using FIPS 204, the Module-Lattice-Based Digital Signature Algorithm (ML-DSA), in Internet X.509 certificates and Certificate Revocation Lists (CRLs). It also describes the conventions for the associated signatures, subject public keys and private key. The RFC describes ML-DSA as a quantum-resistant digital signature scheme standardized by the US National Institute of Standards and Technology (NIST) PQC project.

RFC 9881 covers three security levels: ML-DSA-44, ML-DSA-65 and ML-DSA-87.

Application to Cryptographic Message Syntax

RFC 9882 covers the Cryptographic Message Syntax (CMS). It specifies the conventions for using the ML-DSA signature algorithm with CMS and provides the algorithm identifier syntax. It covers the same three security levels: ML-DSA-44, ML-DSA-65 and ML-DSA-87.

RFC 9882 describes ML-DSA as a post-quantum digital signature scheme that aims to be secure against an adversary in possession of a Cryptographically Relevant Quantum Computer (CRQC). It also says ML-DSA offers smaller signatures and significantly faster runtimes than SLH-DSA, an alternative post-quantum signature algorithm standardised by NIST. That comparison is the RFC's statement. For more information on the security levels and key sizes, RFC 9882 points to Appendix B of RFC 9881.

Algorithm Variants and Security Levels

RFC 9881 says FIPS 204 defines two variants of ML-DSA, pure and pre-hashed, and that only the pure variant is specified in that document. The RFC refers readers to its Section 8.3 for the rationale.

The three levels are labeled ML-DSA-44, ML-DSA-65 and ML-DSA-87. The security goal, being secure against a CRQC, is how RFC 9882 describes the algorithm. It is a design aim, not a statement about deployment.

Implementation Conventions and Identifiers

RFC 9882 says identifiers are used to identify ML-DSA, and provides the algorithm identifier syntax for CMS. RFC 9881 does the same for certificates and CRLs. This article summarises the abstracts and introductions of the two RFCs and does not describe any deployment or product support.

FAQ

Which RFCs cover ML-DSA?

RFC 9881 covers X.509 certificates and CRLs, and RFC 9882 covers the Cryptographic Message Syntax (CMS).

Which security levels are covered?

ML-DSA-44, ML-DSA-65 and ML-DSA-87.

Which ML-DSA variant is specified?

RFC 9881 says FIPS 204 defines pure and pre-hashed variants and that only the pure variant is specified in that document.

How does ML-DSA compare with SLH-DSA?

RFC 9882 says ML-DSA offers smaller signatures and significantly faster runtimes than SLH-DSA.

What is ML-DSA designed to resist?

RFC 9882 says it aims to be secure against an adversary in possession of a Cryptographically Relevant Quantum Computer.